CVE-2019-1003009

2019-02-0616:00:00

jenkins

www.cve.org

cve-2019-1003009

improper certificate validation

active directory plugin

starttls

authentication

EPSS

0.001

Percentile

45.6%

JSON

An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/active_directory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/active_directory/ActiveDirectorySecurityRealm.java, src/main/java/hudson/plugins/active_directory/ActiveDirectoryUnixAuthenticationProvider.java that allows attackers to impersonate the Active Directory server Jenkins connects to for authentication if Jenkins is configured to use StartTLS.

CNA Affected

[
  {
    "product": "Jenkins Active Directory Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "status": "affected",
        "version": "2.10 and earlier"
      }
    ]
  }
]

References

jenkins.io/security/advisory/2019-01-28/#SECURITY-859

EPSS

0.001

Percentile

45.6%

JSON

Related for CVELIST:CVE-2019-1003009